Today
Microsoft released a set of fixes for Remote Desktop Services that include two
critical Remote Code Execution (RCE) vulnerabilities, CVE-2019-1181 and CVE-2019-1182. Like
the previously-fixed ‘BlueKeep’ vulnerability (CVE-2019-0708), these two vulnerabilities are also ‘wormable’, meaning that any
future malware that exploits these could propagate from vulnerable computer to
vulnerable computer without user interaction.
The affected versions of Windows are Windows 7 SP1, Windows Server 2008 R2 SP1, Windows Server 2012, Windows 8.1, Windows Server 2012 R2, and all supported versions of Windows 10, including server versions.
Windows XP, Windows Server 2003, and Windows Server 2008 are not affected, nor is
the Remote Desktop Protocol (RDP) itself affected.
These vulnerabilities
were discovered by Microsoft during hardening of Remote Desktop Services as
part of our continual focus on strengthening the security of our products. At
this time, we have no evidence that these vulnerabilities were known to any
third party.
It is important that affected systems are patched as quickly as possible because of the elevated risks associated with wormable vulnerabilities like these, and downloads for these can be found in the Microsoft Security Update Guide. Customers who have automatic updates enabled are automatically protected by these fixes. By default, Windows 10 Home and Windows 10 Pro users will be updated automatically.
There
is partial mitigation on affected systems that have Network Level
Authentication (NLA) enabled. The affected systems are mitigated against
‘wormable’ malware or advanced malware threats that could exploit the
vulnerability, as NLA requires authentication before the vulnerability can be
triggered. However, affected systems are still vulnerable to Remote Code
Execution (RCE) exploitation if the attacker has valid credentials that can be
used to successfully authenticate.
Resources
Links to downloads
Simon
Pope, Director of Incident Response, Microsoft Security Response Center (MSRC)
